---
id: CVE-2025-68363
title: 'bpf: Check skb->transport_header is set in bpf_skb_check_mtu'
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check skb->transport_header is set in bpf_skb_check_mtu\n\nThe bpf_skb_check_mtu helper needs to use skb->transport_header when\nthe BPF_MTU_CHK_SEGS flag is used:\n\n\t…"
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b <
    b3171a5e4622e915e94599a55f4964078bdec27e
  - >-
    Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b <
    97b876fa88322625228792cf7a5fd77531815a80
  - >-
    Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b <
    30ce906557a21adef4cba5901c8e995dc18263a9
  - >-
    Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b <
    1c30e4afc5507f0069cc09bd561e510e4d97fbf7
  - >-
    Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b <
    942268e2726ac7f16e3ec49dbfbbbe7cf5af9da5
  - >-
    Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b <
    d946f3c98328171fa50ddb908593cf833587f725
  - Linux 5.12
published: '2025-12-24'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T08:43:15.866Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-68363'
references:
  - url: 'https://git.kernel.org/stable/c/b3171a5e4622e915e94599a55f4964078bdec27e'
  - url: 'https://git.kernel.org/stable/c/97b876fa88322625228792cf7a5fd77531815a80'
  - url: 'https://git.kernel.org/stable/c/30ce906557a21adef4cba5901c8e995dc18263a9'
  - url: 'https://git.kernel.org/stable/c/1c30e4afc5507f0069cc09bd561e510e4d97fbf7'
  - url: 'https://git.kernel.org/stable/c/942268e2726ac7f16e3ec49dbfbbbe7cf5af9da5'
  - url: 'https://git.kernel.org/stable/c/d946f3c98328171fa50ddb908593cf833587f725'
tags:
  - cve.org
epss: 0.00207
epssPercentile: 0.09651
ingestedAt: '2026-09-08T15:33:26.996Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check skb->transport_header is set in bpf_skb_check_mtu

The bpf_skb_check_mtu helper needs to use skb->transport_header when
the BPF_MTU_CHK_SEGS flag is used:

	bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS)

The transport_header is not always set. There is a WARN_ON_ONCE
report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set +
bpf_prog_test_run is used:

WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071
 skb_gso_validate_network_len
 bpf_skb_check_mtu
 bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch
 bpf_test_run
 bpf_prog_test_run_skb

For a normal ingress skb (not test_run), skb_reset_transport_header
is performed but there is plan to avoid setting it as described in
commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()").

This patch fixes the bpf helper by checking
skb_transport_header_was_set(). The check is done just before
skb->transport_header is used, to avoid breaking the existing bpf prog.
The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.

## Affected

- `Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b < b3171a5e4622e915e94599a55f4964078bdec27e`
- `Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b < 97b876fa88322625228792cf7a5fd77531815a80`
- `Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b < 30ce906557a21adef4cba5901c8e995dc18263a9`
- `Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b < 1c30e4afc5507f0069cc09bd561e510e4d97fbf7`
- `Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b < 942268e2726ac7f16e3ec49dbfbbbe7cf5af9da5`
- `Linux >= 34b2021cc61642d61c3cf943d9e71925b827941b < d946f3c98328171fa50ddb908593cf833587f725`
- `Linux 5.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.